Is it RollingFileAppender day? Filebeat locks file when logstash is not runnig 
That means application.log (old) and application.log (new) don't have the same inode? And also the file copied over to application.log.timestamp has a different inode? I think we are getting closer 